All Products
Search

This Product

    Key Management Service:Configure Multi-VPC access to KMS instances within the same region

    Document Center

    Key Management Service:Configure Multi-VPC access to KMS instances within the same region

    Last Updated:Sep 20, 2026

    If your self-managed applications are deployed in the same region but distributed across multiple VPCs, you can purchase a Key Management Service (KMS) instance in one of the VPCs and bind the other VPCs to the KMS instance. This way, applications in multiple VPCs can use the same KMS instance. This topic describes how to configure access to a KMS instance for applications in multiple VPCs within the same region.

    Feature overview

    After the configuration is complete, applications in the VPCs can access the keys or secrets in the KMS instance by using the endpoint of the KMS instance. For more information, see the following figure.image

    Usage notes

    • The VPC that you want to bind and the KMS instance must be in the same region.

    • The VPC that you want to bind and the KMS instance can belong to the same Alibaba Cloud account or different Alibaba Cloud accounts.

      If the VPC and the KMS instance belong to different Alibaba Cloud accounts, you must configure resource sharing first. You can share a vSwitch in the VPC with the Alibaba Cloud account to which the KMS instance belongs to enable network communication between the VPCs.

    • When you bind a VPC, you must select a vSwitch. Make sure that the vSwitch has at least one available IP address.

      In the VPC, the domain name of the KMS instance endpoint is resolved to this IP address.

    • Each VPC that is bound to the KMS instance consumes one Access Management Quota quota. To increase the quota, see Upgrade KMS instance.

      Note

      Access Management Quota includes the number of VPCs that are associated with the KMS instance and the number of resource users when you share the KMS instance. For example, if you want to associate your KMS instance with 3 VPCs and share the instance with 2 resource users, the quota of the access management quantity must be at least 5.

    Prerequisites

    • You have purchased and enabled a KMS instance. For more information, see Purchase and enable a KMS instance.

    • If the VPC that you want to bind and the KMS instance belong to different Alibaba Cloud accounts, share a vSwitch in the VPC with the Alibaba Cloud account to which the KMS instance belongs. For more information, see Resource owner enables VPC sharing.

    Procedure

    Configure in the console

    1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Resources > Instances.

    2. On the Instances page, click the tab for the instance.

    3. Find the KMS instance, click Details in the Actions column, and then click the Multi-VPC tab at the bottom of the page.

    4. Click Configure VPCs. In the Configure VPCs panel, select the VPCs that you want to bind in the Available VPCs section, and then click the left arrow icon.

    5. In the Select vSwitch to Associate with VPC dialog box, select a vSwitch for each VPC and click OK.

      Important

      You can select any vSwitch. The vSwitch does not need to be bound to your application, but make sure that the vSwitch has at least one available IP address.

    6. In the Configure VPCs panel, click OK.

    Configure by calling API operations

    Call the UpdateKmsInstanceBindVpc operation.

    Configure by using Terraform

    For more information, see Purchase and enable a software key management instance with Terraform.

    What to do next

    Select an appropriate integration method to access the KMS instance. KMS provides the Alibaba Cloud SDK, secret SDK, KMS Agent, and KMS instance SDK (not recommended) to integrate the keys or secrets of the KMS instance. For more information about KMS integration, see Integrate KMS with self-managed applications.